06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b

General

Target

06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe
Size

960KB
MD5

3a79b1c073348cc0aaf5e6dedb859428
SHA1

41c958593dac9e78e7ba91537ac77a8c5bc556bd
SHA256

06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b
SHA512

725cf692674f42131de3c82bbdc7b33ddb699d8d6296cbd2d6980961535f061de5e9a05a25a84b7aa15ecf555d39e8d637f03f988e4ce492c9a4b468e812db5f
SSDEEP

24576:lLT7B+t+Zu6ACT9JadfCJGC18a/ZSbH77Lh:F/B+t+nhradfCL18g4Hbh

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1332	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe

Executes dropped EXE 1 IoCs

pid	Process
1332	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
11	pastebin.com

Program crash 16 IoCs

pid	pid_target	Process	procid_target
1328	3248	WerFault.exe	81
2200	1332	WerFault.exe	86
4920	1332	WerFault.exe	86
4184	1332	WerFault.exe	86
1424	1332	WerFault.exe	86
1608	1332	WerFault.exe	86
4488	1332	WerFault.exe	86
4068	1332	WerFault.exe	86
1648	1332	WerFault.exe	86
356	1332	WerFault.exe	86
3644	1332	WerFault.exe	86
4572	1332	WerFault.exe	86
2008	1332	WerFault.exe	86
2980	1332	WerFault.exe	86
3620	1332	WerFault.exe	86
2408	1332	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1332	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe
1332	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3248	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1332	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1332	3248	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe	86
PID 3248 wrote to memory of 1332	3248	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe	86
PID 3248 wrote to memory of 1332	3248	06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe	86

C:\Users\Admin\AppData\Local\Temp\06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe
"C:\Users\Admin\AppData\Local\Temp\06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 352
  2⤵
  - Program crash
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe
  C:\Users\Admin\AppData\Local\Temp\06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 344
    3⤵
    - Program crash
    PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 636
    3⤵
    - Program crash
    PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 664
    3⤵
    - Program crash
    PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 708
    3⤵
    - Program crash
    PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 720
    3⤵
    - Program crash
    PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 896
    3⤵
    - Program crash
    PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1400
    3⤵
    - Program crash
    PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1480
    3⤵
    - Program crash
    PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1652
    3⤵
    - Program crash
    PID:356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1688
    3⤵
    - Program crash
    PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1496
    3⤵
    - Program crash
    PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1500
    3⤵
    - Program crash
    PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1480
    3⤵
    - Program crash
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1508
    3⤵
    - Program crash
    PID:3620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 632
    3⤵
    - Program crash
    PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3248 -ip 3248
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1332 -ip 1332
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1332 -ip 1332
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1332 -ip 1332
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1332 -ip 1332
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1332 -ip 1332
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1332 -ip 1332
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1332 -ip 1332
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1332 -ip 1332
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1332 -ip 1332
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1332 -ip 1332
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1332 -ip 1332
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1332 -ip 1332
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1332 -ip 1332
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1332 -ip 1332
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1332 -ip 1332
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\06464b05231007313ceb634404f96dd16e1b96f678904f924c125bc710ce158b.exe

Filesize
960KB

MD5
15954724550ce0253baa36b9b7a9f005

SHA1
0ed3b9209d698d6eda8fdc6d359ac8abe34cd34b

SHA256
73d1036f7ce781251fcf03d00db184c13d67b108291c4bd1ef9815b71daff38b

SHA512
35e8c9308c5721e1f8cd31de3242090f731d9229cda5d2b2a357956b7a1fd47e723c49773aecfe75cba55a356d47ad0e5f0269a9eacabc7140da4c4a54c96b19

Download Submit
memory/1332-7-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1332-8-0x0000000005150000-0x000000000523D000-memory.dmp

Filesize
948KB

Download
memory/1332-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1332-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1332-27-0x000000000B9C0000-0x000000000BA63000-memory.dmp

Filesize
652KB

Download
memory/1332-28-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3248-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3248-6-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download

Analysis

Sharing